feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

lib/api/handleError.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server';
+import { AppError, ValidationError } from '@/lib/errors';
+
+/**
+ * Service層のエラーをHTTPエラーレスポンスに変換する。
+ * 期待されるエラー(AppError)は対応するステータスコードへ、
+ * 予期せぬエラーは500として内部情報を隠蔽する。
+ */
+export function handleApiError(error: unknown): NextResponse {
+  if (error instanceof AppError) {
+    const body: { error: { message: string; field?: string } } = {
+      error: { message: error.message },
+    };
+    if (error instanceof ValidationError && error.field) {
+      body.error.field = error.field;
+    }
+    return NextResponse.json(body, { status: error.status });
+  }
+  console.error('Unexpected error:', error);
+  return NextResponse.json(
+    { error: { message: '内部エラーが発生しました' } },
+    { status: 500 }
+  );
+}
+
+export function jsonError(status: number, message: string): NextResponse {
+  return NextResponse.json({ error: { message } }, { status });
+}